refactor(cli): dedupe model_setup_flows boilerplate

model_setup_flows.py (3313 -> 2848):
- _load_config_model_section, _begin/_commit_model_config, _ensure_flow_api_key,
  _pick_model_or_prompt, _run_login, _models_dev_merged, _copilot_model_list,
  _show_curated replace ~15 copies of config-save / api-key / picker boilerplate.
- _gemini_tier_ok and _api_key_provider_model_list lift the two inline blocks
  out of _model_flow_api_key_provider; five-way provider branch -> early returns.
- Comments compacted, keeping every rationale (Bedrock geo routing, key_env
  hygiene, discover_models semantics, Nous free/paid partition, etc.).

Also drops two tests that only asserted the existence of setup.py helpers
removed in the next commit.

tests/hermes_cli/test_setup.py

@@ -146,7 +146,6 @@ def test_modal_setup_persists_direct_mode_when_user_chooses_their_own_account(tm
 
     monkeypatch.setattr("hermes_cli.setup.prompt_choice", fake_prompt_choice)
     monkeypatch.setattr("hermes_cli.setup.prompt", lambda *args, **kwargs: next(prompt_values))
-    monkeypatch.setattr("hermes_cli.setup._prompt_container_resources", lambda config: None)
     monkeypatch.setattr(
         "hermes_cli.setup.get_nous_subscription_features",
         lambda config: type("Features", (), {"nous_auth_present": True})(),

tests/hermes_cli/test_telegram_managed_bot.py

@@ -200,11 +200,6 @@ class TestPollForToken:
 
 
 class TestSetupTelegramAuto:
-    def test_setup_helper_exists(self):
-        from hermes_cli.setup import _setup_telegram_auto
-
-        assert callable(_setup_telegram_auto)
-
     def test_setup_result_passes_profile_name_for_profile_home(self, monkeypatch, tmp_path):
         from hermes_cli import setup